Google Cuts Videostrong From Android Supply Chain Over Botnet

What changed

Google says Shenzhen-based Videostrong Technology Co., one of its Android manufacturing partners, embedded a backdoor in 1.3 million Android set-top boxes and turned them into a botnet.

Google says it has dismantled the backdoor, cut ties with Videostrong, and banned the company from building or selling certified Android devices or supplying software for them.

Why it matters

The damage reaches beyond one compromised gadget. Owners and operators of the affected boxes may have been running devices that could be controlled as part of a larger network, while Google has treated the manufacturer itself as unfit to remain inside its certified Android supply chain.

That makes certification a practical security boundary, not just a badge on a product page. Once a manufacturing partner can insert software before a device reaches its owner, trust in the box depends on the partner’s access as much as on Google’s operating system.

The reported account does not say how many devices remain compromised, what the botnet did, which models or locations were affected, or what owners must do next. Those details will determine whether this is mainly a contained supply-chain breach or a continuing problem for people still using the boxes.